配置TLS1.3后gRPC Netty客户端与服务端始终建立TLS1.2连接的问题求助

大家好，我遇到一个非常困惑的问题：我在gRPC服务端和客户端都明确配置了TLS1.3协议，但实际通信时始终建立的是TLS1.2连接，想请大家帮忙排查下问题出在哪里。

我的运行环境是Java 11，服务端使用NettyServerBuilder，客户端使用NettyChannelBuilder，两者都通过SslContextBuilder指定了TLS1.3协议，也配置了对应的TLS1.3 cipher套件，但不管是抓包还是日志都显示连接是TLS1.2的，这明显不符合预期。想问下这会不会是gRPC的bug？还是我在配置过程中遗漏了什么细节？

先贴出我的相关代码：

服务端配置代码 #

import io.grpc.ServerCredentials;
import io.grpc.TlsServerCredentials;
import io.grpc.netty.shaded.io.netty.handler.ssl.SslContext;
import io.grpc.netty.shaded.io.netty.handler.ssl.SslContextBuilder;
import io.grpc.util.AdvancedTlsX509TrustManager;
import io.grpc.Server;
import io.grpc.netty.shaded.io.grpc.netty.NettyServerBuilder;
import io.grpc.netty.shaded.io.netty.handler.ssl.SslContext;
import io.grpc.stub.StreamObserver;

private Server myServer;
CertificateData grpcCertificateData = CertificateData.SERVER_CERT;

try {
    KeyManager serverKeyManager = myCertificateHandlerService.getServerKeyManagers(grpcCertificateData.getServiceGroup())[0];
    LOG.info("Retrieved key manager: {}", serverKeyManager);
    
    X509TrustManager trustManager = (X509TrustManager) myCertificateHandlerService.getServerTrustManagers(grpcCertificateData.getServiceGroup())[0];
    X509Certificate[] acceptedIssuers = trustManager.getAcceptedIssuers();
    LOG.info("Retrieved CA certificates: {}", acceptedIssuers);
    
    SslContextBuilder builder = SslContextBuilder.forServer(serverKeyManager)
            .trustManager(trustManager)
            .clientAuth(ClientAuth.REQUIRE)
            .ciphers(CIPHER_SUITES_SUPPORTED)
            .protocols(TLS_VERSION_1_3); // 明确指定TLSv1.3
            .sslProvider(SslProvider.JDK);
    
    NettyServerBuilder serverBuilder = NettyServerBuilder.forPort(PORT)
            .sslContext(GrpcSslContexts.configure(builder).build())
            .addService(new LoadReportingRpcService());
    
    myServer = serverBuilder.directExecutor().build();
    myServer.start();
} catch (Exception e) {
    LimitedLogger.logOrSuppressError(LOG, LOG_MESSAGE_DATA, "Failed to build SSL context {}", e);
}

客户端配置代码 #

import io.grpc.LoadBalancerRegistry;
import io.grpc.ManagedChannel;
import io.grpc.ManagedChannelBuilder;
import io.grpc.NameResolverRegistry;
import io.grpc.StatusRuntimeException;
import io.grpc.internal.DnsNameResolverProvider;
import io.grpc.internal.PickFirstLoadBalancerProvider;
import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder;
import io.grpc.netty.shaded.io.netty.handler.ssl.SslContext;
import io.grpc.stub.StreamObserver;

String serviceGroup = CertificateData.CERT_CLIENT.getServiceGroup();

try {
    TrustManager[] caTrustManagers = myCertificateHandlerService.getServerTrustManagers(serviceGroup);
    KeyManager[] clientKeyManagers = myCertificateHandlerService.getClientKeyManagers(serviceGroup);
    
    if (caTrustManagers == null || clientKeyManagers == null) {
        LOG.error("NN Failed to retrieve PKI components. Server trust manager was {}, client key manager was {}, for service group {}", caTrustManagers, clientKeyManagers, serviceGroup);
    } else {
        LOG.error("NN Configure TLS1.3 client");
        
        X509TrustManager caTrustManager = (X509TrustManager) caTrustManagers[0];
        KeyManager keyManager = clientKeyManagers[0];
        
        SslContextBuilder sslContextBuilder = SslContextBuilder.forClient()
                .trustManager(caTrustManager)
                .keyManager(keyManager)
                .protocols(TLS_VERSION_1_3);
                .sslProvider(SslProvider.JDK)
                .ciphers(CIPHER_SUITES_SUPPORTED);
        
        ManagedChannelBuilder<?> channelBuilder = NettyChannelBuilder.forAddress(target, GRPC_PORT);
        channelBuilder.directExecutor();
        
        LOG.error("NN tls enabled {}", isTlsEnabled());
        if (isTlsEnabled()) {
            LOG.error("NN tls enabled and start secure grpc client");
            ((NettyChannelBuilder) channelBuilder).sslContext(GrpcSslContexts.configure(sslContextBuilder).build()).useTransportSecurity();
        }
        
        foundChannel = channelBuilder.build();
        ReportingServiceGrpc.ReportingServiceStub stub = ReportingServiceGrpc.newStub(foundChannel);
        stub.invokeRpcMethod();
    }
} catch (Exception e) {
    LOG.error("Failed to create ssl context for {}", serviceGroup, e);
}

共用的Cipher套件配置 #

private static final Iterable<String> CIPHER_SUITES_SUPPORTED = Arrays.asList(
        "TLS_AES_256_GCM_SHA384",
        "TLS_AES_128_GCM_SHA256",
        "TLS_CHACHA20_POLY1305_SHA256"
);

我已经确认Java 11本身是支持TLS1.3的，而且代码里也明确通过protocols(TLS_VERSION_1_3)指定了协议版本，但为什么还是会回退到TLS1.2呢？有没有可能是gRPC Netty的配置存在隐藏的问题？或者我的代码里有什么细节没注意到？

麻烦大家帮忙分析一下，谢谢！

内容来源于stack exchange